Analysis Instruction Manual In 1996, Marine Atlantic was the first Canadian ferry operation to become International Safety Management (ISM) certified. In applying the ISMCode, shipping companies such as Marine Atlantic mitigate human performance-based decisions that may lead to an accident. The provision of adequate policies and procedures enables the ship's crew to be better equipped to make correct decisions of a day-to-day operational nature. To implement the ISMCode, Marine Atlantic established, among other things, instructions and procedures to further safety and for environmental protection. In the case of machinery operations, such procedures must encompass the machinery manufacturer's instructions, and such instructions must be readily available to ensure that machinery is operated safely and efficiently. Although there was a boiler instruction manual on board, key engineering personnel were unaware of its location. Consequently, adjustments to the ignition electrodes were made by best estimate rather than being set precisely in accordance with the manual. It was also determined, after obtaining the instruction manual (which was found to be incomplete and somewhat disorganized), that the pilot burner fuel pressure had been set much lower than that specified. A second boiler instruction manual discovered onboard several days later was also found to be incomplete and disorganized. Primary Fan Photo 6 - Primary fan with motor removed At the time of the occurrence, the electric motor for the primary fan was still ashore for repairs, and the starboard auxiliary boiler was being operated without it (see Photo6). This resulted in less than adequate atomization of the fuel from the main burner and an unstable main flame. It would also cause large droplets of unburned fuel oil to carry over and accumulate in the secondary and tertiary register air boxes, as well as in the combustion chamber. Although the primary fan motor on the mechanically-defective port boiler was available, it was originally hoped that repairs to the port boiler would have been completed sooner than they ultimately were. Consideration, therefore, was not given to having it replace the missing motor on the starboard unit. The functioning of the primary fan is essential to safely operate the boiler. Fuel Pressure Setting of Burner The main fuel oil pressure observed at 2bar, fell within the acceptable range of 1to 3bar for light fuel operation as indicated in the boiler instruction manual.16 The pilot burner fuel oil pressure at 2.5bar, however, fell well below the designed working pressure of 7bar. At this lower pressure, the atomization of the pilot burner fuel would have been very poor and would have caused unburned droplets of fuel to collect in the combustion chamber. The pilot burner nozzle in use at the initial boiler flame out was a 2.5gph unit. This nozzle was removed and replaced with a 2.0gph unit. According to the SUNROD instruction manual, the recommended pilot burner nozzle should range between 4.5gph and 5.5gph. The boiler manufacturer however, indicated that a 2.0gph nozzle would be acceptable if the fuel oil pressure was set at 7bar. At the time of the occurrence, the boiler was not being operated in accordance with the manufacturer's instructions and specifications. The smaller-than-specified burner nozzle and low fuel pressure, combined with the lack of combustion air from the primary fan, made the pilot burner flame difficult to ignite, which resulted in the multiple flame failures of the main burner prior to the explosion. Emergency Running Switch The emergency running switch, as its name implies, is to be used only in an emergency or when carrying out tests on the boiler. Since its use must be carefully controlled, it is fitted with a key. Despite the danger associated with unauthorized use of the emergency running switch, the key was left in the switch. After the occurrence, considerable resistance was felt as the key was removed from the switch. This, coupled with signs of corrosion, indicates that the key had not been recently removed from the switch. Furnace Explosion Photo 7 - External damage to starboard auxiliaryboiler Throughout the afternoon, unsuccessful attempts were made to restart the boiler in both the automatic and emergency modes. Because the vessel's AMS was not fitted with a data-logging printer, the exact number of attempts could not be determined. At least four attempts were made to restart the boiler with the system on automatic, and one, possibly two, attempts were made to restart the boiler while firing on emergency. During an emergency firing, the duration of fuel injection is manually controlled by the operator. The boiler instruction manual warns against introducing fuel for more than five seconds without repurging the boiler for at least 30seconds. Whether this warning was heeded could not be determined; however, it is known that the manufacturer's manual was not readily available for reference by the engineers. With each failed attempt, unburned fuel would have been sprayed into the combustion chamber and air boxes, and onto the firebricks which lined the furnace floor. Until the time of the occurrence, the boiler had operated throughout the day and would have been at a temperature well above the flash point of the unburned fuel. Some of the fuel would have vaporized in the furnace, with the remaining residue likely seeping down between the joints in the fire bricks. When the chief and second engineers left the starboard auxiliary boiler, the main power switch was left in the ON position, the emergency running switch was in the automatic position, and the hand-auto switch was either in the automatic or in the manual position. Therefore, it is likely that soon after the emergency running switch was switched to automatic, the oil burner control commenced a normal start-up cycle. The first furnace explosion was the result of the ignition and instantaneous combustion of a flammable air-fuel mixture that had carried over from the secondary and tertiary register air boxes and had accumulated in the combustion chamber and uptake. The likely source of ignition was the pilot burner ignitor. The second and third explosions were most likely secondary (tertiary) explosions. Photo 8 - Pooled fuel oil in air boxes The cause of the fires that followed each of the three furnace explosions were likely the result of the ignition of the fuel oil that had pooled in the secondary and tertiary register air boxes and its subsequent discharge out of the boiler during each explosion (see Photo8). Since the starboard auxiliary boiler was in a less than ideal operational condition with the primary fan unit being out of commission, using it required that all possible safety measures be taken beforehand. Injuries to Crew Of the three individuals who were working on the starboard auxiliary boiler during the afternoon of the occurrence, the second engineer was not near the boiler when either of the explosions occurred and, therefore, did not sustain any injuries. The chief engineer was standing near the boiler. He sustained burns to his legs, torso, arms, and face during the second explosion that were consistent with the effects of a flame front. As such, had his clothing had flame-retardant properties, the severity of the injuries to his torso and legs would have been mitigated. The shirt worn by the chief engineer had short sleeves; shirts that qualify as flame retardant must have long sleeves to provide a measure of protection to the arms. The senior chief electrical officer was not directly affected by the flame fronts from the first and second explosions. As the result of the flame front from the third explosion, his pants, safety-vest, and battle jacket caught fire; however, these flames were extinguished before he sustained any serious injury. The burns to his left hand and wrist occurred while fighting the fires following the explosions. While his injuries were not affected by the characteristics of the clothing he was wearing, the lack of fire-retardant properties in his pants, safety-vest, and battle jacket exposed him to an increased risk of serious injury. Provision of Protective Clothing The protective clothing available on the market includes items manufactured with fabric blends of 88percent cotton and 12percent high-tenacity nylon that is treated to not support combustion once the ignition source is removed. However, the coveralls supplied by the owners as protective clothing for use in the engine room environment were either 65percent polyester, 35percent cotton, or 100percent cotton and were not fire resistant. Given the risk exposure of shipboard personnel to fire incidents, the protective gear supplied or available to the crew was not consistent with their risk exposure profile. The starboard auxiliary boiler was not being operated in accordance with the manufacturer's instructions and specifications. The boiler manufacturer's instruction manuals were not readily available, were not referenced by the crew, and were disorganized and incomplete. The starboard auxiliary boiler was being operated without a primary air fan, and was left unattended with the power switch ON and the unit on automatic. The furnace explosions were the result of a series of uncontrolled ignitions of an accumulated combustible fuel/air mixture within the enclosed space of the furnace combustion chamber and uptake. The fires were likely the result of the ignition of the fuel oil that had pooled in the secondary and tertiary register air boxes and its subsequent discharge out of the boiler during each explosion.Findings as to Causes and Contributing Factors The starboard auxiliary boiler was not being operated in accordance with the manufacturer's instructions and specifications. The boiler manufacturer's instruction manuals were not readily available, were not referenced by the crew, and were disorganized and incomplete. The starboard auxiliary boiler was being operated without a primary air fan, and was left unattended with the power switch ON and the unit on automatic. The furnace explosions were the result of a series of uncontrolled ignitions of an accumulated combustible fuel/air mixture within the enclosed space of the furnace combustion chamber and uptake. The fires were likely the result of the ignition of the fuel oil that had pooled in the secondary and tertiary register air boxes and its subsequent discharge out of the boiler during each explosion. The key to the emergency burner control switch was stored in the switch. Clothing worn by the chief engineer and senior chief electrical officer had no flame-retardant properties and offered no protection against the flame fronts of the explosions. This contributed to the severity of the chief engineer's injuries and exposed the senior chief electrical officer to the risk of sustaining more extensive and serious injuries. The protective clothing supplied to the crew by the owners was inconsistent with the crew's risk profile.Findings as to Risk The key to the emergency burner control switch was stored in the switch. Clothing worn by the chief engineer and senior chief electrical officer had no flame-retardant properties and offered no protection against the flame fronts of the explosions. This contributed to the severity of the chief engineer's injuries and exposed the senior chief electrical officer to the risk of sustaining more extensive and serious injuries. The protective clothing supplied to the crew by the owners was inconsistent with the crew's risk profile. Safety Action Action Taken The following safety action was initiated by Marine Atlantic Incorporated. A complete boiler instruction manual that was held ashore was reproduced, and two copies were placed on board the vessel. The in-service and stand-by pilot burner fuel oil pump pressures were adjusted to specification. The in-service and stand-by main burner fuel oil pump pressure were adjusted to specification. Two additional auxiliary boiler emergency shutdowns were installed in strategic locations throughout the engine room spaces. The starboard auxiliary boiler was fitted with a new burner unit under the supervision of a factory service engineer. The port auxiliary boiler was adjusted to the manufacturer's specification by a factory service engineer. It is the company's intention to segregate and provide independent fuel systems for each boiler in May 2005. The Personal Protective Equipment Program has been enhanced to ensure that a proper assessment of any task is carried out, and that correct personal protective equipment is obtained to provide the necessary protection for employees. A Job Safety Analysis Program has been developed. Under this program, tasks will be assessed to identify associated risks before work is undertaken. The dynamics of the safety management system documentation has been used to ensure that all employees working in the engine room now wear Marine Atlantic-provided fire-retardant coveralls. Action Required Simply stated, the purpose of the Marine Occupational Safety and Health Regulations (MOSH) made pursuant to the Canada Labour Code PartII (the Code) is to protect employees against health and safety hazards on the job. Preventive measures should first require the elimination of hazards or, if this is not possible, the reduction of such hazards and, finally, the provision of personal protective equipment, clothing, devices, or materials, all with the goal of ensuring the health and safety of employees.17 While the goal of internal company safety management systems is, in part, to identify and manage the hazards on board vessels, not all hazards can be totally eliminated. Vessels have numerous sources of flash fires: boilers, engine crankcases, medium-voltage electrical equipment, galleys, and cargo operations to name a few. Since flash fires can occur without warning, identifying hazards and using appropriate personal protective equipment is quite important. The MOSH regulations includes provisions for head, foot, eye, face, skin, respiratory, and fall protection. Specific Canada Shipping Act standards are set for headgear, footwear, face, eye, and fall protection; however, no such references are made to protective clothing. The requirement for skin protection cites protection in the form of an "appropriate body covering." Such a general reference may not provide vessel operators or crew with adequate guidance for choosing protective clothing sufficient to protect against identified risks such as flash fires. The Code and associated MOSH regulations are predicated on the requirement that a vessel operator assesses all inherent risks, including the risk of flash fires, and provides protective clothing as necessary. The Board notes however that few Canadian shipping companies require the use of flame-retardant clothing in high risk areas. As a result, and as evidenced by this occurrence, crew members on Canadian vessels may be placed at unnecessary risk. Therefore, the Board is concerned that the MOSH regulations pursuant to the Canada Labour Code PartII, or other publications distributed by Transport Canada, do not provide adequate guidance for either assessing the risks of flash fires, or for choosing suitable flame-retardant protective clothing. The Board will be monitoring the situation with a view to assessing the need for further safety action on this issue.